Author Topic: Suspicious whitespace sequence  (Read 6341 times)

0 Members and 1 Guest are viewing this topic.

kalipto

  • Guest
Suspicious whitespace sequence
« on: January 12, 2004, 01:01:43 PM »
Hi,

Sometimes, I received JPG pictures by mail whose titles contain 6 white spaces instead of one. For instance: "town near      the river". Avast doesn't really appreciate it and displays a "Suspicious message" window mentioning a "suspicious whitespace sequence"  ???
Since I don't think the picture sender intentionnaly inserted white spaces in his picture title (it happens regularly with always 6 white spaces instead of 1), does someone know if a virus could do that ? I tried to make research on google for that but I didn't find anything. These pictures were stored on an iPaq before being sent to me. This behavior is recent. No problem before.
Thanks for your help.

Culpeper

  • Guest
Re:Suspicious whitespace sequence
« Reply #1 on: January 22, 2004, 04:37:43 AM »
Have you completed a virus scan yet?  If nothing shows up than you probably have nothing to worry about, naturally.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Suspicious whitespace sequence
« Reply #2 on: January 22, 2004, 12:02:10 PM »
The message is (a bit) suspicious because some viruses use the following trick: they've an attachment called e.g.

Info.txt                                                                               .exe

Because the window in which the names are displayed has a size limitation, it's quite likely that the .exe extension will not be displayed (will be clipped), making the user think that it's a TXT file, instead of an EXEcutable.

If you want, you can turn off the whitespace checking but in 99.9% of cases you shouldn't really see any (legal) attachments with names like that...
If at first you don't succeed, then skydiving's not for you.

kalipto

  • Guest
Re:Suspicious whitespace sequence
« Reply #3 on: January 23, 2004, 05:13:08 PM »
Thanks a lot for your answers. :)
Actually, I scanned  my disk and found no particular viruses.
I am really happy to understand why Avast was so suspicious. But the attached files with names with spaces were no exe (pcw or most often jpg). So I don't really know the reason of these additional spaces. Maybe a mailer bug. But the pocket PC (iPaq) where the original files were stored before being mailed to me, had been infected previously by a virus called "HTML.redolf.A". I mean the storage card contained files infected by this virus. The infected files were supposed to be eradicated. But I don't really think there is a link...